What Is The Domain Generation Algorithm
Domain generation algorithm dga.
What is the domain generation algorithm. A domain generation algorithm dga is a computer program that creates slightly different variations of a given domain name. Kraken was the first malware family to use a dga in 2008 that we could find. Dga by itself can t harm you. Domain generation algorithm dga what is it.
Domain generation algorithms dga are algorithms seen in various families of malware that are used to periodically generate a large number of domain names that can be used as rendezvous points with their command and control servers the large number of potential rendezvous points makes it difficult for law enforcement to effectively shut down botnets since infected computers will attempt to. The algorithm roughly consists of these three steps. The domain generation algorithm of bazarloader is in a single function including seeding click to enlarge. Domain generation algorithms create a constantly moving target that cyber defenders struggle to successfully hit with a blocklist.
What are domain generation algorithms dgas. Determine the first six letters of the second level domain at random. Traditionally malware used to have hard coded domain names or ip addresses to connect directly with the command and control c c or c2 server. All dgas are based off of a static and dynamic seed which ensures that the domains are constantly changing.
Attackers use dga so they can quickly switch the command and control also called c2 or c c servers that they. Dga is a technique that fuels malware attacks. Domain generation algorithms dga is a methodology for malware to form a command and control c c c2 connection without being detected. A domain generation algorithm is a program that is designed to generate domain names in a particular fashion.
Attackers developed dgas so that malware can quickly generate a list of domains that it can use for the sites that give it instructions and receive information from the malware usually referred to as command and control or c2. Part of this is due to how the algorithm is set up and how easy they are to update. In contrast dgas use algorithms to periodically generate a large number of domain names which function as rendezvous points for malware command and. A domain generating algorithm dga is a program or subroutine that provides malware with new domains on demand or on the fly.
Later that year conficker made dga a lot more famous.